Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 09 Sep 2014 13:46:30 +1000
From: Murray McAllister <>
Subject: Re: [CVE Requests] rsync and librsync collisions

Good morning,

The below still require a CVE or two (unless MITRE disagrees).


Murray McAllister / Red Hat Product Security

On 08/05/2014 04:03 PM, Michael Samuel wrote:
> Hi,
> I think there should be CVEs assigned for this:
> rsync: MD5 collision DoS attack or limited file corruption
> librsync: MD4 collision file corruption
> Note: librsync is not the same code, protocol or maintainer as rsync.
> The librsync attack is far easier to perform, since there's no
> whole-file checksum and it will simply copy the first instance of a
> collision into any place where the second collision is.
> The rdiff utility that ships with librsync truncates hashes to 8
> bytes, allowing a very fast and efficient birthday attack - so even if
> MD4 was replaced attacks would still be possible while the hash is
> truncted.  This also affects duplicity - they both use
> RS_DEFAULT_STRONG_LEN - so the _librsyncmodule that ships with
> duplicity will need recompiling after the fix ships.
> Previous posting for context:
> Regards,
>    Michael

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.